Go backend / Product / Case study
Siouve
An AI-assisted platform for continuous, consent-driven support between psychology professionals and the people they accompany.
01 / Idea
Start with a real professional workflow.
Siouve grew from a product problem discussed with a psychology professional: important experiences happen between sessions, and people forget details or lose the sequence of events.
It gives the patient a private space to talk and record their days. When they authorize it, a bounded period becomes a concise, traceable view for the connected professional. It is not a diagnostic system, and its AI does not replace professional judgment.
02 / Stack
A Go control plane, a Python inference plane.
The backend is Go on the standard net/http package and pgx, with PostgreSQL and Goose migrations. The AI service is Python with FastAPI, Pydantic and LangGraph. The patient and professional apps are two Next.js 16 applications in a pnpm monorepo that share UI and API-client packages.
Authentication combines short-lived signed JWTs over revocable server sessions, rotating refresh credentials, Argon2id and Google Identity. Professional routes require a stronger session established with WebAuthn passkeys.
Backend
Go · net/http · pgx · Goose
Domain modules with handler → service → repository layers. PostgreSQL is both the source of truth and the durable job coordinator.
Identity
WebAuthn passkeys · JWT · Argon2id
Short-lived signed tokens over revocable server sessions, with passkey step-up for professional routes.
AI
Python · FastAPI · LangGraph · Pydantic
A stateless inference plane that receives bounded context and returns strictly validated output.
03 / Architecture
Two journeys. One consent boundary.
The Go service is the system boundary: it authenticates callers, applies consent and tenancy rules, encrypts sensitive fields, manages durable jobs and owns persistence. Model behavior stays outside the authorization boundary.
The AI layer deliberately uses no vector database, embeddings or general-purpose RAG. The current workflows are served with bounded, authorized context and a smaller attack surface.
01 / Responsibility
Patient
Conversations with Si, daily check-ins, threads, and explicit consent at account and relationship level.
02 / Responsibility
Professional
Expiring invitations, connections, structured check-ins and time-bounded context reports — never the raw transcript.
03 / Responsibility
Go control plane
Authentication, consent, tenancy, application-layer encryption, durable workers and persistence.
04 / Responsibility
Python inference plane
No database access, no autonomous tools and no authority over permissions. It only sees what the Go service sends.
04 / Flow
Make information useful to the professional.
Conversation and longitudinal reporting are separate pipelines. Streamed text is released only after incremental validation and reconciled before the final response is persisted.
Reports run through bounded extraction and synthesis stages. Every statement is grounded in references to messages the patient wrote, and consent is revalidated at the moment of execution.
- 01
Record
The patient talks with Si and answers daily check-ins; messages are encrypted and written idempotently.
- 02
Request
The professional asks for a bounded period. Nothing is shared until the patient explicitly confirms.
- 03
Synthesize
A durable worker revalidates consent, then extracts and synthesizes the period through the AI service.
- 04
Review
Each statement stays linked to patient-authored evidence; the professional remains responsible for interpretation and care.
05 / Challenges
Reliable work without a separate broker.
Reports and account email have to survive a process failure. PostgreSQL records the work; workers claim it with leases, retry with bounded backoff and recover abandoned jobs, and a transactional outbox keeps email durable while the provider is down.
Model output is treated as untrusted. A malformed or ungrounded report fails its provenance or schema check and is never shown; the job is retried or recorded as a terminal failure. Payment processing is planned work, not shipped infrastructure.
06 / Status
A real product in production.
Siouve is live at siouve.com. The backend covers segmented identity, consent records, encrypted conversations, streaming AI responses, durable background work and versioned migrations.
The production source is private because Siouve is a commercial product. A public engineering case study documents its architecture, decisions and reliability model.